Apple Computer has shipped an update to its WebObjects Xcode plug-in to correct a flaw that could allow remote attackers to bypass certain security restrictions.
In an alert posted online, Apple, based in Cupertino, Calif., said the vulnerability is due to missing access restrictions on the WebObjects Xcode plug-in network service.
It can be exploited to gain access to and modify WebObjects projects on a system via the network service without requiring authentication.
“This update addresses the issue by limiting this service to the local system. This issue does not affect default installations of Xcode Tools,” Apple said, noting that only systems with the WebObjects plug-in installed are affected.
The fix has been included in Version 2.3 of the tool.
Cisco Patches VPN Vulnerability
Network routing and switching giant Cisco Systems, in San Jose, Calif., has issued a warning for a local privilege escalation vulnerability affecting the Cisco VPN Client for Windows.
In an advisory, Cisco said the bug could allow non-privileged users to gain administrative rights. However, a user needs to authenticate and start an interactive Windows session to be able to exploit the flaw.
The vulnerability is caused by an unspecified error in the GUI, also known as the “VPN client dialer,” and can be exploited to execute arbitrary commands with system privileges, the company said.
Cisco recommends that users update to Version 4.8.01.0300 immediately.
The Cisco VPN Client is a software service for the Sun Solaris, Apple Mac OS Classic and Mac OS X, Linux, and Microsoft Windows operating systems that allows users running these operating systems to establish IP Security VPN tunnels to Cisco VPN-capable devices.
